CVE-2026-121731

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...